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1 LISTING OF THE CLAIMS 

2 What is claimed, is: 

3 1 . (original) A method of monitoring events in a computer network, the method comprising: 

4 said computer network triggering said events, each event being provided with attribute values 

5 allocated to a given set of attributes, 

6 providing an event display with a cross plot having x and y coordinate axes, the x-axis presenting 

7 a time period and the y-axis presenting an attribute value range, 

8 determining a primary attribute of the events selected fix>m the given set of attributes to be 

9 presented with its attribute values on the y-axis of the cross plot, 
10 

1 1 allocating a first display label to the events indicating the attribute values of the primary attribute, 

1 2 providing a pattern algorithm to detect whether an arrived event is part of the given pattern on the 

13 basis of a comparison of the attributes allocated to the given pattern and of the attributes assigned 

14 to the arrived event, providing a mapping algorithm to map any attribute value of an attribute 

1 5 selected from the given set of attributes onto the y-axis of the cross plot, 

16 allocating a second display label to the events indicating the attribute values of the attributes 

1 7 being uncovered as part of the given pattern, plotting all the events arrived within the time period 

1 8 and including an attribute value allocated to the primary attribute into the cross plot with the first 

1 9 display label indicating the primary attribute, the position of the first display label of each event 

20 in the cross plot being determined on the basis of the attribute value of the primary attribute of 

21 the event and its arrival time, and 

22 plotting the all events arrived within the time period and being detected by means of the pattern 

23 algorithm as part of the given pattern into the cross plot with the second display label indicating 

Application/Control Number: 10/798,070 2/20 
PAGE 2/21 * RCVD AT 11/28/2005 3:36:35 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-6/31 * DMS:2738300 * CSID:84535231 94 * DURATION (mm-ss):06-06 



11/28/2005 16:34 8453523194 



PAGE 



DOCKET NUMBER: CH920020049US1 

1 the given pattern, the position of the second display label of each event in the cross plot being 

2 determined by the mapping algorithm on the basis of the attribute value of the attribute of the 

3 event being uncovered as part of the given pattern and its arrival time. 

4 2. (original) The method according to claim 1 , further comprising: 

5 recording the attribute values and the arrival time of a new event, determining on the basis of the 

6 recorded attribute values of event whether or not the newly arrived event includes an attribute 

7 value of the primary attribute, and if the newly arrived event includes the attribute value for the 

8 primary attribute shifting the x-axis of the cross plot so that the time period being presented on 

9 the x-axis covers the arrival time of the event, and 

10 plotting the event arrived within the shifted time period into the cross plot with the first display 

1 1 label indicating the primary attribute. 

12 3 . (original) The method according to claim 2 comprising the further steps of: 

13 detennining on the basis of the recorded attribute values of event whether or not the newly 

14 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 

15 to the given pattern and of the attributes assigned to the arrived event, 
16 

17 if the newly arrived event includes an attribute value of the given pattern adding the event to the 

1 8 previous events being detected as part of the given pattern, and 

1 9 redrawing all the events being associated with given pattern in the cross plot. 

20 4. (original) The method according to claim 3, further comprising: 
21 

22 if the newly arrived event does not include an attribute value of the given pattern, determining on 

23 the basis of the recorded attribute values of all previous arrived events by means of the pattern 
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1 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 

2 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

3 arrived events; 

4 if the newly arrived event forms together with previous recorded events the new pattern, 

5 allocating a third display label to the events indicating the attribute values of the attributes being 

6 uncovered as part of the new pattern; and 

7 plotting the all events being detected by means of the pattern algorithm as part of the new pattern 

8 into the cross plot with the third display label indicating the new pattern, the position of the third 

9 display label of each event in the cross plot being determined by the mapping algorithm on the 

10 basis of the attribute value of the attribute of the event being uncovered as part of the new pattern 

1 1 and its arrival time. 

12 5. (original) The method according to claim 1 , norther comprising: 

1 3 removing all the events including an attribute value aUocated to the primary attribute from the 

14 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 

1 5 plot is changed, allocating a fourth display label to the events indicating the attribute values of 

1 6 the new primary attribute, and 

1 7 plotting all the events arrived within the time period and including an attribute value allocated to 

1 8 the new primary attribute into the cross plot with the fourth display label indicating the new 

1 9 primary attribute, the position of the fourth display label of each event in the cross plot being 

20 determined on the basis of the attribute value of the primary attribute of the event and its arrival 

21 time. 

22 6. (original) The method according to claim 1 comprising the further steps of plotting all 

23 attribute values recorded for an event with the respective display label into the cross plot if the 
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1 event is selected by an operator, and displaying textual information associated with the selected 

2 event on the event display. 

3 7. (original) The method according to claim 1, wherein the pattern algorithm is suitable to 

4 perform multi-attribute pattern recognition. 

5 8. (original) The method according to claim 1, wherein each display label includes a specific 

6 color and/or a specific mark layout 

7 9. (original) The method according to claim 1, wherein all events being uncovered as part of the 

8 pattern are clustered by the corresponding display labeL 

9 10. (original) A computer program containing a program code to carry out the steps of the 

10 method of claim 1 , when the program code is running on a computer, 

11 11. (original) A computer program containing a program code to carry out the steps of the 

12 method of claim 1 , said program code being stored on data carrier. 

13 12. (original) An event visualization device for monitoring events in a computer network, the 

14 device comprising means to perform the steps of the method as claimed in claim 1 . 

15 13. (original) An article of manufacture comprising a computer usable medium having computer 

1 6 readable program code means embodied therein for causing monitoring of events in a computer 

1 7 network, the computer readable program code means in said article of manufacture comprising 

1 8 computer readable program code means for causing a computer to effect the steps of claim 1 . 

19 14. (original) A program storage device readable by machine, tangibly embodying a program of 

20 instructions executable by the machine to perform method steps for monitoring events in a 

21 computer network, said method steps comprising the steps of claim 1 . 
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1 15. (original) A computer program product comprising a computer usable medium having 

2 computer readable program code means embodied therein for causing the event visualization 

3 device, the computer readable program code means in said computer program product 

4 comprising computer readable program code means for causing a computer to effect the 

5 functions of claim 1 2. 

6 16. (new) The method according to claim 1, further comprising: 

7 recording the attribute values and the arrival time of a new event, determining on the basis of the 

8 recorded attribute values of event whether or not the newly amved event includes an attribute 

9 value of the primary attribute, and if the newly arrived event includes the attribute value for the 

1 0 primary attribute shifting the x-axis of the cross plot so that the time period being presented on 

1 1 the x-axis covers the arrival time of the event, 

12 plotting the event arrived within the shifted time period into the cross plot with the first display 

1 3 label indicating the primary attribute; 

14 determining on the basis of the recorded attribute values of event whether or not the newly 

1 5 arrived event is part of the given pattern on the basis of a comparison of the attributes allocated 

16 to the given pattern and of the attributes assigned to the arrived event; 

17 if the newly arrived event includes an attribute value of the given pattern adding the event to the 

1 8 previous events being detected as part of the given pattern; 

19 redrawing all the events being associated with given pattern in the cross plot; 

20 if the newly arrived event does not include an attribute value of the given pattern, determining on 

2 1 the basis of the recorded attribute values of all previous arrived events by means of the pattern 

22 algorithm whether or not the newly arrived event is part of a new pattern on the basis of a 
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1 comparison of the attributes allocated to the new pattern and of the attributes assigned to the 

2 arrived events; 

3 if the newly arrived event forms together with previous recorded events the new pattern, 

4 allocating a third display label to the events indicating the attribute values of the attributes being 

5 uncovered as part of the new pattern; and 

6 plotting the all events being detected by means of the pattern algorithm as part of the new pattern 

7 into the cross plot with the third display label indicating the new pattern, the position of the third 

8 display label of each event in the cross plot being determined by the mapping algorithm on the 

9 basis of the attribute value of the attribute of the event being uncovered as part of the new pattern 

1 0 and its arrival time; 

11 17. (new) The method according to claim 1 6, further comprising: 

12 removing all the events including an attribute value allocated to the primary attribute from the 

13 cross plot, if a primary attribute to be presented with its attribute values on the y-axis of the cross 

1 4 plot is changed, allocating a fourth display label to the events indicating the attribute values of 

15 the new primary attribute, and 

16 plotting all the events arrived within the time period and including an attribute value allocated to 

1 7 the new primary attribute into the cross plot with the fourth display label indicating the new 

1 8 primary attribute, the position of the fourth display label of each event in the cross plot being 

1 9 determined on the basis of the attribute value of the primary attribute of the event and its arrival 

20 time. 

21 18. (new) The event visualization device for monitoring events in a computer network, according 

22 to claim 12, further comprising: 
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1 means for recording the attribute values and the arrival time of a new event, means for 

2 determining on the basis of the recorded attribute values of event whether or not the newly 

3 arrived event includes an attribute value of the primary attribute, and if the newly arrived event 

4 includes the attribute value for the primary attribute shifting the x-axis of the cross plot so that 

5 the time period being presented on the x-axis covers the arrival time of the event, 

6 means for plotting the event arrived within the shifted time period into the cross plot with the 

7 first display label indicating the primary attribute; 

8 means for determining on the basis of the recorded attribute values of event whether or not the 

9 newly arrived event is part of the given pattern on the basis of a comparison of the attributes 

10 allocated to the given pattern and of the attributes assigned to the axxived event; 

1 1 means for adding for if the newly arrived event includes an attribute value of the given pattern 

12 adding the event to the previous events being detected as part of the given pattern; 

13 means for redrawing all the events being associated with given pattern in the cross plot; 

14 means for determining if the newly arrived event does not include an attribute value of the given 

1 5 pattern, means for determining on the basis of the recorded attribute values of all previous 

16 arrived events by means of the pattern algorithm whether or not the newly arrived event is part of 

17 a new pattern on the basis of a comparison of the attributes allocated to the new pattern and of 

1 8 the attributes assigned to the arrived events; 

1 9 means for allocating if the newly arrived event forms together with previous recorded events the 

20 new pattern, allocating a third display label to the events indicating the attribute values of the 

21 attributes being uncovered as part of the new pattern; and 

22 means for plotting the all events being detected by means of the pattern algorithm as part of the 

23 new pattern into the cross plot with the third display label indicating the new pattern, the position 
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1 of the third display label of each event in the cross plot being determined by the mapping 

2 algorithm on the basis of the attribute value of the attribute of the event being uncovered as part 

3 of the new pattern and its arrival time; 

4 19. (new) The event visualization device for monitoring events in a computer network, according 

5 to claim 1 8, further comprising: 

6 means for removing all the events including an attribute value allocated to the primary attribute 

7 from the cross plot, if a primary attribute to be presented with its attribute values on the y-axis of 

8 the cross plot is changed, allocating a fourth display label to the events indicating the attribute 

9 values of the new primary attribute, and 

10 means for plotting all the events arrived within the time period and including an attribute value 

1 1 allocated to the new primary attribute into the cross plot with the fourth display label indicating 

12 the new primary attribute, the position of the fourth display label of each event in the cross plot 

1 3 being determined on the basis of the attribute value of the primary attribute of the event and its 

14 arrival time. 

15 20. (new) An article of manufacture comprising a computer usable medium having computer 

1 6 readable program code means embodied therein for causing monitoring of events in a computer 

1 7 network, the computer readable program code means in said article of manufacture comprising 

1 8 computer readable program code means for causing a computer to effect the steps of claim 16. 
19 



Application/Control Number 1 0/798,070 9/20 

PAGE 9/21 * RCVD AT 1 1/28/2005 3:36:35 PM [Eastern Standard Time] * SVR:USPTOff XRF-6/31 * DNIS:2738300 * CSID:8453523194 * DURATION (mm-ss):0W)6 



